Watch an AI Agent Try to Spend Money It Shouldn't

This report covers a live demonstration of an AI agent attempting to spend money on a tool it should not be able to use. The story begins by explaining the background of two important specifications: x402 and MCP. x402 is a status code designed to indicate that a server requires payment before granting access to a resource. MCP, or the Model Context Protocol, is a protocol used by AI agents to discover and call tools.

In July 2026, the latest version of MCP was released, which moved pricing and routing metadata into HTTP headers.

The report goes on to explain the importance of these two specifications and how they work together. Both x402 and MCP moved important metadata out of request bodies and into headers, making it easier for gateways, rate limiters, and web application firewalls (WAFs) to see who is calling, which tool is being used, and what it costs.

However, the report argues that just because infrastructure can see the price does not mean it has the authority to approve or disapprove the payment. This is a crucial point that the report emphasizes throughout the story.

The report then describes a live demonstration of an AI agent attempting to spend money on a tool it should not be able to use. The agent has a task to enrich a customer record, but it does not know what the cost of the task is or which provider will perform it. The agent asks the system for the price, but the system refuses to provide it, stating that the agent does not have the necessary authorization to approve the payment.

The report highlights that asking for the price is free, but if the cost of obtaining that information itself incurs a charge, then every agent would need spending authority before it could plan its actions, thereby pushing the authorization decision to the least informed moment in the entire flow.

The report then goes on to explain the different components involved in this process. There is the agent, which decides what work to do and holds no private key. There is the enforcement gateway, which is the only permitted route out and can see every request twice, deciding whether to allow or deny the request. There is the authorization service, which decides whether spending is permitted and reserves the budget.

There is the signing service, which produces signatures and can refuse if the signature is invalid. Finally, there is the protected resource, which is the tool that costs money and is behind a paid server.

The report stresses that in this scenario, all components are honest but fallible, and compromised binaries, malicious operators, key extraction from hardware, and chain-level attacks are out of scope. Instead, the focus is on a specific design decision that matters more than it looks. The report argues that asking for the price is free, and if finding out what something costs itself costs money, then every agent needs spending authority before it can plan, which pushes the authorization decision to the least informed moment in the entire flow. This is a critical point that the report makes throughout the story.

Overall, this report provides a detailed and in-depth look at the challenges of implementing a system where AI agents can spend money on tools they should not be able to use. The report highlights the importance of moving important metadata into headers, but also emphasizes that just because infrastructure can see the price does not mean it has the authority to approve or disapprove the payment.

The report also stresses the importance of pushing the authorization decision to the least informed moment in the entire flow, as asking for the price is free, but if the cost of obtaining that information itself incurs a charge, then every agent would need spending authority before it can plan.